1. Harness Your Internet Activity

2. Random Subdomain Attacks Plaguing the Internet

3. Brief Intro –Covered at last OARC –Attack overview Latest data –Progress on open dns proxies in home gateways –Impact of Response Rate Limiting? –Chinese pornography sites –Hong Kong news site Testing resolvers –(Over) ambitious idea! What can we do? –Success filtering ingress traffic, some challenges –??? 3 Agenda

4. 4 Random Subdomain Attacks RANDOMTARGET NAME wxctkzubkb..liebiao.800fy.com qzgziliv. 11hehe.com two labels three labels

5. Random Subdomain Attacks 1 Internet Query with randomized subdomains 2 Authoritative Server Compromised hosting Recursive queries Open DNS Proxy (Home Gateway) 3 NXD responses ISP Target Web Site Open DNS Proxies are the Vector for Attacks ISP Resolver

6. 6 Latest Data: Unique Names Millions Start of attack activity Jan 28, 2014

7. 7 Impact of Response Rate Limiting Border Home Gateway Resolver Authority Spoofed IP Query (UDP): Ivatsnkb.web.pay1.cn Proxy query, translate IP Recursion NXD Spoofed IP Proxy query, translates IP Spoofed IP Query (UDP): Ivatsnkb.web.pay1.cn Proxy query, translate IP Recursion Truncate Bad Case Worse Case Response Rate Limiting Retry TCP NXD Proxy query, translates IP Spoofed IP Attacker

8. 8 Attacks at Scale Proxy query, translate IP Recursion Truncate Response Rate Limiting Border Home Gateway Resolver Authority Attacker Retry TCP Authority Fails High traffic with TCP overhead Resolver doesn’t get responses, tries new Authorities, cascading failures Spoofed IP Randomized queries Resolver stress TCP overhead

9. Sept 28, 2014 UTC Height of Hong Kong democracy protests Distinct shift in tactics – 98% of attacks on one domain –Typical day 4-6 domains attacked, usually gaming sites Hong Kong online news Passion Times Website offline 13 hours 9 Hong Kong News Site

10. Sept 25/26 2014 (UTC) Another shift in tactics 42 domains attacked simultaneously Attack lasted 6 hours Most web sites went down Motive for most attacks remains unclear –Monetization is likely very modest –Collateral damage across the Internet far exceeds revenue from DDoS for hire 10 Chinese Pornography Sites

11. 11 Sept 25/26 Attacks Data from 5 providers Volume of attack queries In Millions Small fraction of overall attack activity Nominum est << 5% 80 40 10 45 25 5

12. 12 Sept 25/26 Attacks Data from 5 providers % attack queries 60 30 10 35 20 5

13. 13 Oct 3- 6 Attacks In-media is an Independent Hong Kong news site 25 15 5 millions

14. Home Gateways mask the spoofed source IP –“Challenges”, “DNS cookies” won’t work at either resolvers OR authorities –Queries are from legitimate IPs – blacklisting eliminates all traffic for those IPs Response Rate Limiting by authorities increases the workload for both resolvers and authorities –It was designed for attacks directly on authoritative servers –Rate limiting resolvers is counter productive Surrounding recursion with too much logic can be problematic –Doesn’t address root cause –Collateral damage is observed: Servers marked as non-responsive by recursor recovering but still not being used Nameservers serving multiple domains taken out of service by traffic for one domain Tendency for cascading failures –Authorities successively fail increasing stress on remaining authorities –This in turn increases stress on resolvers 14 Many Problems to Address

15. Filter traffic at ingress to the resolver –Near real time block lists Randomized subdomains used for attacks Protect good traffic –Whitelist Fine grained policy –Tie the lists together: Block bad traffic Answer good traffic 15 Solutions IDEAS?

16. Goal: Understand impact of PRSD on resolvers –BIND –PowerDNS –Undound –Vantio Method: Simulate DNS E-E behavior –Attack behaviorEasy –ResolversEasy –AuthoritiesHard –Variability of InternetVery hard Whoops! 16 Testing Resolvers

17. Authoritative server answers up to threshold, then randomly drops Authoritative server switches to TCP at threshold, then restricts tcp connection slots Authoritative server drops traffic for attack domains, answers other domains Authoritative server doesn’t answer, other servers for domain successively fail, vary latency response latency IDEAS? 17 Current Test Plan